Tag: 2.3

WordPress 2.3.3 has been released and this release includes a security fix (xmlrpc.php) and 3 minor bug fixes.
3 bug fixes as follows (Ctrl C + Ctrl V from WordPress Trac):

• gettext fails to determine byteorder on 64bit systems with php5.2.1
• some registration emails fail in 2.3.1 b/c of “callout verification”
• maybe_create_table call to config.php issue

5 files changed (Thanks to whooami):

• /wp-admin/install-helper.php
• /wp-includes/gettext.php
• /wp-includes/pluggable.php
• /wp-includes/version.php
• /xmlrpc.php

Get WordPress 2.3.3 now.

WordPress 2.3.2 has been released and this release includes a number of changes including one security fix.

• Performance improvements for post sanitization when raw content is required.
• Changes to is_admin() to ensure that it is only true for admin pages thereby protecting against exposing draft posts.
• Suppression of database errors unless WP_DEBUG is true.
• Check for valid database connection information during install and display and error if the install fails due to database rights.
• Support for a custom database down page to be displayed on database connection errors.
• Changes to make sure we are more selective in what we make clickable, this introduces different rules for different uri types.
• Changes to wp-mail.php to escape the error messages when displaying them to avoid a possible XSS attack.
• Changes to ensure that the post password is only exposed by the xmlrpc method metaWeblog.getRecentPosts to users with rights to edit a post.
• Changes to the information exposed the wp.getAuthors xmlrpc method to reduce the information exposed and add a capabilites check.
• Addition of extra capabilites checks to xmlrpc methods.
• Addition of extra capabilites checks to APP server.
• Changes to validate_file() to improve its traversal attempt detection when running on windows.

Get yours today.

WordPress 2.3.1 has been released and this fix is a bug-fix and security release for the 2.3 series.

An XSS issue has been fixed here:

A security fix to ensure that edit-post-rows.php cannot be directly loaded to prevent XSS attacks when register_globals is enabled

Get yours today.